You're wrong. It has auto-escaped since Rails 3.
Rails changed the default to safe output about three years ago. 3.0 escaped output out of the gate, and 2.3 switched the default in the 2.3.6 neighborhood.
Prior before that, the standard way to sanitize html output was to write <%= h foo %> instead of <%= foo %> in your templates.
http://stackoverflow.com/questions/698700/escaping-html-in-r...
Correct me if I am wrong but it seems to me that RoR still isn't shipped with a safe default?
Edit: RoR added auto-escaping around February 2010, Django had it since November 2007
http://yehudakatz.com/2010/02/01/safebuffers-and-rails-3-0/ https://code.djangoproject.com/wiki/AutoEscaping?x=52&y=...